---
title: Self Hosted Cloudflare
description: "Run Executor as a single Cloudflare Worker in your own account, with Cloudflare Access for auth and D1 for storage."
---

Executor runs as a single Cloudflare Worker. Authentication is handled entirely by
[Cloudflare Access](https://developers.cloudflare.com/cloudflare-one/policies/access/)
(there is no separate app login), storage is [D1](https://developers.cloudflare.com/d1/),
tool code runs in QuickJS inside the Worker, and the web console, API, and MCP
endpoint are all served from that one Worker.

It is single-tenant: every Access-verified user belongs to the one configured org,
and you manage members and credentials in Cloudflare Access rather than in the app.

## Prerequisites

- A Cloudflare account with Workers and Zero Trust (Access) enabled.
- The [Executor repo](https://github.com/RhysSullivan/executor) checked out, with
  dependencies installed (`bun install`).

## Deploy

From `apps/host-cloudflare`:

```bash
bunx wrangler login
bun run deploy:setup
```

`deploy:setup` is idempotent: it creates or reuses the `executor` D1 database,
writes its id into `wrangler.jsonc`, generates and uploads the `EXECUTOR_SECRET_KEY`
secret, and deploys the Worker. It then prints the one remaining manual step.

## Put it behind Cloudflare Access

Until the Worker is behind an Access application, every API and MCP route returns
`401`. In the Zero Trust dashboard:

1. Go to **Access → Applications → Add an application → Self-hosted**.
2. Set the application domain to `executor-cloudflare.<your-subdomain>.workers.dev`.
3. Add an Access policy (for example, emails ending in `@yourcompany.com`).
4. Copy the application **Audience (AUD)** tag, then redeploy with your Access settings:

   ```bash
   bunx wrangler deploy \
     --var ACCESS_AUD:<aud> \
     --var ACCESS_TEAM_DOMAIN:<your-team>.cloudflareaccess.com
   ```

   You can also set `ACCESS_AUD` and `ACCESS_TEAM_DOMAIN` in `wrangler.jsonc` and
   redeploy.

Now visiting the Worker prompts a Cloudflare Access login, and the Worker validates
the issued JWT on every request.

## Connect an agent

The Worker serves a streamable-HTTP MCP endpoint at `/mcp`, gated by Access like the
rest of the surfaces. Point your client at
`https://executor-cloudflare.<your-subdomain>.workers.dev/mcp`; it authenticates
through Cloudflare Access. See [MCP Proxy](/mcp-proxy) for how the endpoint exposes
your integrations.